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A coin is just a two sided dice. Recently, Mochon proved that quantum weak 
coin flipping with an arbitrarily small bias is possible. However, the use of quantum 
resources to allow N remote distrustful parties to roll an iV-sided dice has yet to be 
addressed. In this paper we show that contrary to the classical case, iV-sided dice 
rolling with arbitrarily small bias is possible for any N. In addition, we present a six- 
round three-sided dice rolling protocol, achieving a bias of 0.181, which incorporates 
weak imbalanced coin flipping. 
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I. INTRODUCTION 

<n : 

Coin flipping is a cryptographic problem in which a pair of remote distrustful parties, usually referred to as Alice 
^ ■ and Bob, must generate a random bit that they agree on. There are two types of coin flipping protocols. In weak coin 
flipping (WCF) one of the parties prefers one of the outcomes and the other prefers the opposite, whereas in strong 
coin flipping (SCF) each party does not know the other's preference. The security of a WCF protocol is quantified by 
| the biases ca and es; if PjJ and P B are the maximal winning probabilities achievable by a dishonest Alice and Bob, 
then 

^ e *=^*-5' i = AB. (1) 

+-> ■ . 

<**] ■ The biases tell us to what extent each of the parties can increase their chances of winning beyond one half. 
e=max(eA, e_e) is often referred to as the bias of the protocol. Correspondingly, in SCF there are four biases. 

1 ^ i ' 1 The problem of coin flipping was first introduced by Blum in 1981, who analyzed it in classical settings [l|. It 

was subsequently shown that if there are no limitations on the parties' computational power a dishonest party can 
04 ' always force any outcome they desire Q . With the publication of the quantum key distribution protocol of Bennett 
and Brassard in 19840, it was realized that many communication tasks that are impossible in a classical setting 
may be possible in a quantum setting. In 1999 Goldenberg et at introduced a quantum gambling protocol 0, 
which is a problem closely related to WCF (see |5j). The first quantum (strong) coin flipping protocol per se was 
presented by Aharonov et al. in 2000 6]. The protocol achieves a bias of \/2/4 ~ 0.354 0. Soon afterward Spekkens 
and Rudolph H, and independently Ambainis [§], devised a SCF protocol with a bias of 1/4. On the other hand, 
Kitaev subsequently proved that there is a limit to the efficacy of SCF protocols 10]: Any SCF protocol must satisfy 
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Q\ , P A ' ■ P B ' > 1/2, i <G {0, 1}, where P\ {Pb ) * s dishonest Alice's (Bob's) maximal probability of forcing the 
outcome i. As regards WCF, in 2002 Spekkens and Rudolph introduced a family of three rounds of communication 
protocols in which both dishonest parties have a bias of (v2 — l)/2 ~ 0.207 [llj. Mochon then imp roved upon 
Spekkens and Rudolph's result by constructing WCF protocols with an infinite number of rounds [12J, ll_3j • These 
efforts culminated in a proof that WCF with an arbitrarily small bias is possible [l4j. Most recently, building upon 
Mochon's latest result, Chailloux and Kerenidis devised a SCF protocol, which saturates Kitaev's bound in the limit 



of an infinite number of rounds 15 1 



The paper is constructed as follows. In section II we define the problem of dice rolling and prove that, using 
quantum resources, dice rolling with an arbitrarily small bias is possible. This result stands in marked contrast to the 
classical case, where, under certain conditions, an honest party always loses. In section III we analyze a three-round 
weak imbalanced coin flipping protocol, which generalizes the results of Spekkens and Rudolph to the imbalanced case. 
The protocol is then used in section IV to implement a six-round three-sided dice rolling protocol; the motivation 
being to provide an indication of the degree of security achievable by a protocol with a minimal number of rounds of 
communication. We conclude with a short discussion. 



II. QUANTUM DICE ROLLING WITH ARBITRARILY SMALL BIAS 



It is straightforward to generalize the problem of coin flipping to multi-party settings. In multi-party coin 
flipping N remote distrustful parties must decide on a bit. An analysis of multi-party SCF in a quantum setting 
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was carried out in [16[, and similarly to the two-party case, it was shown that the use of quantum resources is 
advantageous. Another possible generalization is the problem of N remote distrustful parties having to agree on 
a number from 1 to N, with party i preferring the i-th outcome. To the best of our knowledge this problem has 
never been considered in classical settings. We shall term this problem "dice rolling" . For N = 2 the problem 
reduces to WCF, while for A > 2, there are now many different cheating scenarios, as any number of parties 
n < N may be dishonest. We will be interested in the N "worst case" scenarios where all but one of the parties 
are dishonest and, moreover, are cooperating with one another. That is, the dishonest parties share classical and 
quantum communication channels. In addition, we will require that the protocol be "fair" in the sense that the 
honest party's maximum losing probability be the same in each of these N scenarios. Of course, the security 
of the protocol can be evaluated with respect to any other cheating scenario, but as we will consider only fair 
protocols, the security of any cheating scenarios is never poorer than that provided by the aforementioned N scenarios. 

We begin by observing that in coin flipping protocols the bias has a complementary definition. We could just as 
well define it as 

e;=Jf-l/2, i = A, B (2) 

where P* = Pj^i is the maximum probability that party i loses. According to this definition the bias tells us to what 
extent party j^j can increase the other party i's chances of losing beyond one half. In the case of A parties, the bias 
Ii then tells us to what extent the N — 1 dishonest parties can increase party i's chances of losing beyond 1 — 1/N, 
rather than to what extent a sole dishonest party can increase its chances of winning beyond 1/N. We shall always 
use this redefinition of the bias when considering dice rolling. The computation of biases in dice rolling is therefore 
equivalent to the computation of biases in a weak imbalanced coin flipping protocol. 

We shall now prove that that quantum weak iV-sided dice rolling with arbitrarily small bias is possible for any N. 
The proof is by construction. Consider the following A-party protocol. Each party is uniquely identified according to 
a number from 1 to N. The protocol consists of A — 1 stages. In stage one parties 1 and 2 "weakly flip" a balanced 
quantum coin. The winner and party 3 then weakly flip an imbalanced quantum coin in stage two, where if both 
parties are honest 3's winning probability equals 1/3. And so on, the rule being that in stage n > 2 the winner of 
stage n — 1 and party n "weakly flip" an imbalanced quantum coin, where if both parties are honest, n's winning 
probability equals 1/ (n + 1). Thus, if all parties are honest each has the same overall winning probability of 1/N. 
Using Mochon's formalism [3, Chailloux and Kerenidis have recently proved that weak imbalanced coin flipping 
with arbitrarily small bias is possible (l5j . It follows that in the limit where each of the weak imbalanced coin flipping 
protocols, used to implement our dice rolling protocol, admits a vanishing bias (and N is finite), any honest party's 
winning probability tends to 1/N; for a formal proof see the appendix. Moreover, since we have considered the worst 
case cheating scenario, this result holds for any other cheating scenario. 

The above result is in stark contrast to the classical case where if the number of honest parties is not strictly 
greater than N/2, then the dishonest parties can force any outcome they desire. To see why this is so, let us consider 
a classical A-sided dice rolling protocol and partition the parties into two groups of m < [A/2] and n = N — rn 
parties. If both groups are honest, the probability that a party in the first (second) group wins is m/N (1 — m/N). 
Therefore, any dice rolling protocol can serve as a weak imbalanced coin flipping protocol. Suppose now that all of 
the parties in the second group are dishonest, and are nevertheless unable to force with certainty the outcome they 
choose. Clearly, this would still be the case even if they were the smaller group, i.e. n < m (m > [A/2]), and we 
get a contradiction, since in classical weak imbalanced coin flipping (as in weak balanced coin flipping) at least one 
of the parties should always be able to force whichever outcome they desire [l7| . 

III. A THREE-ROUND WEAK IMBALANCED COIN FLIPPING PROTOCOL 

In this section we analyze a three-round weak imbalanced coin flipping protocol based on quantum gambling. It is 
constructed such that if both parties are honest Alice's winning probability equals 1 — p. Interestingly, it turns out 
that this protocol coincides with the generalization of Spekkens and Rudolph's work to the imbalanced case. The 
protocol will be used in the subsequent section to implement a six-round three-sided dice rolling protocol. 

The protocol 



1. Alice prepares a superposition of two qubits 

\ifa) = V± - p - v\hU) + Vp + v\lih) , 0< v <l- P , 



(3) 
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where the subscripts serve to distinguish between the first and second qubit and will be omitted when the 
distinction is clear. She then sends the second qubit to Bob. 

2. Bob carries out a unitary transformation U v on the qubit he received and another qubit (labelled by the subscript 
3) prepared in the state |J.) such that 



hh) - u„ \hh) = \/ — ^ — \hU) + J \l2h) , (4) 
" p + v V p + v 



and 



\hh) - U v \l 2 h) = J -7- IT2I3) - J-T-llaTs) , (5) 



p + r\ V V + V 

with U n acting trivially on all other states. The resulting state is then 



|Vi)=f/JV'o) = y/l-p-V IT1I2I3) +VP\iihis) + v^UiMs) • (6) 

Following this, he checks whether the second and third qubits are in the state | T2J.3)- 

3. Bob wins if he finds the qubits in the state | T2 4^3) - Alice then checks whether the first qubit is in the state 
in which case Bob passes the test. If Bob does not find the qubits in the state IT2J.3), be asks Alice for the first 
qubit and checks whether all three qubits arc in the state 



10- =\/ 1 1 P _ p V \hl2U) + Jj^\lihh) , (7) 



in which case she passes the test. 



Alice's maximal bias 



Most generally Alice can prepare any state of the form 

Wo) = E a ^ ly> ® i $ y> - ( 8 ) 

where the \$ij) are states of some ancillary system at her possession. After Bob applies U v the resulting composite 
state is given by 

K> = u v \%) ® 14) = a TT (v^ITU) + v^lUT)) ® I*tt> (9) 
+«u ITII) ® |*u) + "it (y^UU) + y^IUT)) ® I$it) + "11 IIH) ® |*u> • 

The probability that Bob does not find find the second and third qubits in the state IT2J.3) is 



p ip 1 NtI 2 p+ NtI 2 p 

-Ml = 1 ~~ "tl = 1 

p + r] 



(10) 



and the resulting composite state then is 

IV4> = A" (a n IT4T) ® |* n > + "ti ITU) ® |*u> 
+ a iT^5lUT>®l*iT>+«iiUU)®l ( i>ii>) , (11) 

where A", the normalization, is 

^-i-^(KtI 2 + KtI 2 ). (12) 
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The probability that Alice passes the test is therefore given by 



^test = ||<e I ^2>ll =^ 



l-p-y 
l-p 



(1 -p) {p + Tf) 



I$1T> 



(13) 



The maximum obtains for = |^J.t)- This choice of the ancillary states does not affect the maximum of P[|. 

Hence, Alice obtains no advantage by using ancillary systems and we can do away with them. Alice's maximum 
cheating probability is then 



PX = maxP n • P tost . 



(14) 



where now 



Tl ' "test 



l-p 



(1 - p) (p + v) 



(15) 



(Pfj. = l/Af 2 ). Clearly, this expression is maximum when = an = 0. Therefore, to maximize her chance of 
successfully cheating Alice will prepare a state of the form 



|^) = \/r^|Ti| 2 )+\^|4iT2} , 

where with no loss of generality we have set a-fi = \/I — S and «|j = VS. So that 



Pa = max 



'(l-p-»j)(l-J) 



rf 2 6 



l-p 



(1 -p)(p + rf) 



(16) 



(17) 



Bob's maximal bias 



Bob wins and passes the test whenever Alice does not find the first qubit in the state ||). The probability for 
this is just p + rj. This gives an upper bound on Bob's maximal cheating probability which is reached if Bob always 
announces that he has won. That is, 

P* B =P + rf. (18) 



Biases in the balanced case 



In the balanced case a protocol is fair if P\ = Pg. We can play with rf to make P\ and P B minimal under this 
constraint. It is easy to show that the minimum then obtains for rf = (\/2 — l) /2. It follows that = eg = 
(V2 - 1) /2 and P% = P B = 1/V2. 



IV. A SIX-ROUND THREE-SIDED DICE ROLLING PROTOCOL WITH A BIAS OF 0.181 



Apart from the inherent limitations on the security of a multi-party quantum cryptographic protocol, it is most 
interesting, both from a theoretical and a practical viewpoint, to determine what degree of security is afforded using 
the least amount of communication. In this section we introduce a six-round three-sided dice rolling protocol following 
the general construction presented in the second section. The protocol consists of two three-round stages. In the 
first stage, we have Alice and Bob flip a balanced quantum coin. Following this, in the second stage, the winner and 
Claire flip an imbalanced quantum coin, such that if both parties are honest Claire's winning probability equals 1/3. 
The protocol is considered fair if PJ = P B = Pq. Due to the protocols' symmetry with respect to the interchange of 
Alice and Bob there are only two noncquivalent worst case scenarios, i.e. either only Alice is honest or only Claire is 
honest. 
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Using the protocol in the previous section an honest Alice has a maximum chance of 1 — l/v2 of progressing to 
the second stage. Therefore, Alice's maximum losing probability is given by 



A V2 



n 



2/3 ■ 



while an honest Claire's maximum losing probability is given by 



Pr 



n* 



/3- 



(19) 



(20) 



with II:[y 3 (II2/3) the maximum losing probability of the party with a winning probability of 1/3 (2/3) when both 
parties are honest. Hence, we require that 



n 



1/3 



1 

71 



1 - 



V2 



n 



2/3 ■ 



(21) 



If we use the WCF protocol of the previous section to implement the second stage, then n^ 3 and njj/g, and hence the 

P* , will depend on 77. We then have to minimize the P* with respect to r\ under the constraint that they are all equal, or 
what is the same thing, minimize n*^ 3 under the constraint eq. (20). However, there are two possible implementations. 

Either 1 — p = 2/3 and the second stage begins with Alice preparing the state a/2/3 — rj IT1I2) + \/l/3 + 77 IJ.1T2)) or 
else 1 — p = 1/3 and the second stage begins with Claire preparing the state \/l/3 — r\ IT1I2) + \/2/3 + rj | J. it 2)- In 
the first case we have to compute 



mm max — 

n 8 2 





under the constraint that 

1 / v/(2 - 377) (1 - S) 
while in the second case we have to compute 

under the constraint that 




1 

V2 



1 

V2 



3 + " 



mm 



n+V = 



V2 



1 



max 
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The first of these yields the lower bias ca 
yields a bias of 0.199. 



y/(l 3 V ) (1 - S) 

is = €c — 0.181 corresponding to P\ 



(2 + 3r?) 



P* 



(22) 



(23) 



(24) 



(25) 



0.848. The second 



V. SUMMARY AND DISCUSSION 



We have defined and studied a novel mutli-party generalization of weak coin flipping, which we have termed dice 
rolling. In A^-sided dice rolling N remote distrustful parties must decide on a number between 1 and N, with party i 
having the preference for outcome i. We have shown that for any bias £ < 1 there exists a quantum protocol such 
that an honest party is always guaranteed a 1/N — e chance of winning. This is in contrast with classical protocols 
where for n < [A/2] honest parties, the dishonest parties can force any outcome they desire. We have also presented 
a six-round three-sided dice rolling protocol in which the honest party's maximum losing probability equals 0.848 as 
compared to the 2/3 that obtains when all parties are honest. Finally, this problem also admits a "strong" variant 
in which M > 2 remote distrustful parties must agree on a number between 1 and N > 2, without any party being 
aware of any other's preference. Kitaev's bound generalizes to these cases. In partciular, for M = 2 it can be 
saturated, as will be shown in an upcoming publication (l8j . 

We thank Lev Vaidman and Oded Regev for useful comments. N. Aharon acknowledges the support of the 
Wolfson Foundation. J. Silman acknowledges the support of the the Israeli Science Foundation. 
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APPENDIX A 



For any dice rolling protocol, based on weak imbalanced coin nipping according to the scheme presented in section 
II, party n's maximum chance of losing is given by 

Pn = ^ + = K-i + U-=o (i - K-i +j ) (Ai) 

where LT^ is party n's maximum chance of losing stage k conditional on having made it to that round and 5k the 
corresponding bias. If we now let 5mlx= maxj, 5k and 5^ n = min^- 5~k (k = n — 1, . . . , N — 1), then 

tn i Omra + + l^k=n "mm J I Ij= 1 U+J+l "minj 

r(n) / 1 , ?(«) \ i-rfc-n-1 / n+j r(n) \ 

°min 2^fc=n \^fe + 0max J Ilj = l U+j+1 °minj 

_fW V JV-1 / i -f(n) Wl_ r(n) \ v fc-n-l n ( n+j _ \ 
°minZ^fc=n \k ° max J \n Q mm)L^m=\ llj^m °mm) 

, , -\ \ yrk- n-1 n+j 

"max f "max l^k=n n Hj=l n+j + 1 

< JVJ&k (A2) 

Hence, if each of the weak imbalanced coin flipping protocols, used to implement the dice rolling protocol, are such 
that Smax <C 1/JV for any n, an honest party's winning probability tends to 1/N. 
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